OWASPASVS 5.0 requirement
ASVS-V14.3.1 Authenticated data is cleared from client storage, such as the browser dom, after the client or session is terminated.
- Standard
- OWASP ASVS 5.0
- Chapter
- V14 Data Protection
- Section
- V14.3 Client-side Data Protection
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that authenticated data is cleared from client storage, such as the browser DOM, after the client or session is terminated. The 'Clear-Site-Data' HTTP response header field may be able to help with this but the client-side should also be able to clear up if the server connection is not available when the session is terminated.